Authentication and the Have I Been Pwned API • Hacker News Board

Re: Authentication and the Have I Been Pwned API

#121

Post by zaroth » Mon, Jul 22, 2019, 4:02 PM UTC

diminoten wrote: post #118

jtbayly wrote: post #117

Earlier quoted context omitted.

You can’t have it both ways. Either it’s widely available, or it isn’t. If it’s already widely available then HIBP doesn’t accomplish anything. (It doesn’t anyway, since it doesn’t “shame” anybody except people who are already signed up, who only need and get their own info.) If it isn’t widely available then HIBP is helping people who are bad at collecting and using this information to do so. We accept that from bug…

You're not getting that the alternative is much worse. Your data is out there. Period. The end. You don't have control over that. All you're doing is trying to re-establish control over data you already lost. The question now is, do you want it only in the hands of people who want to harm you, or do you want it in the hands of both people who want to harm you as well as people who want to help you? You seem to only w…

Now apply this same thinking to the Equifax breach and millions of credit reports.

Now apply this same thinking to the OPM breach and security clearances.

Now apply this same thinking to medical records breaches.

I don't want anyone to have my data, but I resign myself to the fact that data security is, and never will be perfect. That does not mean I resign myself to the fact that all my personal data should be freely available to the entire world via a well documented REST API.

Re: Authentication and the Have I Been Pwned API

#122

Post by zaroth » Mon, Jul 22, 2019, 4:05 PM UTC

diminoten wrote: post #120

jtbayly wrote: post #119

Earlier quoted context omitted.

Thanks for the explanation. I get your point now. I did not find BFDM’s proposed benefits from white hats having access to be compelling. So what I’m struggling with is simply the idea that anybody could do something good with my data. If only bad can be done, then the fewer people spreading the data around, the better. Your presupposition is that some people will do good with it if they have access that currently on…

1Password tells you which of your passwords have been part of a breach. Many other companies will suspend the accounts of anyone whose login information to their leaked as part of another site's breach. Other websites won't allow you to use a password that's listed as a common password from the aggregated passwords in breaches. Lots of studies have been done on password frequency, such as the top 100 most common pass…

> 1Password tells you...

This is software acting as an agent of the effected user. 1Password could be authorized by the email holder to gain access to the API without making the information public.

> Other websites won't allow you to use...

This and the following example in your comment are discussing the breached password API, which is a completely different API that I specifically mentioned up-front as not compromising any PII.

I take zero issue with providing an API to see counts of how many times a password has shown up on breach lists, although I wouldn't use the API myself on any of my own passwords, because it leaks a 1-in-1-million discriminator to the actual password you are querying.

Re: Authentication and the Have I Been Pwned API

#123

Post by diminoten » Mon, Jul 22, 2019, 6:47 PM UTC

zaroth wrote: post #122

diminoten wrote: post #120

Earlier quoted context omitted.

1Password tells you which of your passwords have been part of a breach. Many other companies will suspend the accounts of anyone whose login information to their leaked as part of another site's breach. Other websites won't allow you to use a password that's listed as a common password from the aggregated passwords in breaches. Lots of studies have been done on password frequency, such as the top 100 most common pass…

> 1Password tells you... This is software acting as an agent of the effected user. 1Password could be authorized by the email holder to gain access to the API without making the information public. > Other websites won't allow you to use... This and the following example in your comment are discussing the breached password API, which is a completely different API that I specifically mentioned up-front as not compromi…

You don't get to take issue with any of this. Your information was already stolen! You have no say, the end.

Re: Authentication and the Have I Been Pwned API

#124

Post by jtbayly » Mon, Jul 22, 2019, 7:11 PM UTC

diminoten wrote: post #123

zaroth wrote: post #122

Earlier quoted context omitted.

> 1Password tells you... This is software acting as an agent of the effected user. 1Password could be authorized by the email holder to gain access to the API without making the information public. > Other websites won't allow you to use... This and the following example in your comment are discussing the breached password API, which is a completely different API that I specifically mentioned up-front as not compromi…

You don't get to take issue with any of this. Your information was already stolen! You have no say, the end.

So your fallback position is that it is perfectly legitimate to traffic in stolen PII. Got it.

Well, I take issue with that.

Re: Authentication and the Have I Been Pwned API

#125

Post by diminoten » Wed, Jul 24, 2019, 4:16 AM UTC

jtbayly wrote: post #124

diminoten wrote: post #123

Earlier quoted context omitted.

You don't get to take issue with any of this. Your information was already stolen! You have no say, the end.

So your fallback position is that it is perfectly legitimate to traffic in stolen PII. Got it. Well, I take issue with that.

Yes, in some cases it's perfectly legitimate to "traffic" (terrible word choice) in stolen PII, that is correct.

And my "fallback" position is that it's better this way than the other way, where it's actually being trafficked, rather than your hyperbolic assertion that it is now.